Skip to content

BlazePhoenix bug bounty programs

blazephoenix.xyz Updated

BlazePhoenix runs one public program: a self-hosted disclosure program with no cash rewards.

Top reward
No cash
Disclosure only
Programs
1
None pays cash
Targets in scope
16
5 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program BlazePhoenix runs.

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

16 targets. 5 excluded.

  • blazephoenix.xyz

    Domains

  • blazephoenix.xyz — the swap, staking and api tabs

    Domains

  • blazephoenix.xyz/mcp, /.well-known/mcp.json, /agents, llms.txt and the machine-readable files

    Web

  • Website (blazephoenix.xyz swap, staking and API tabs)

    Web

  • /api/quote, /api/verify, /api/stats, /api/tape, /api/openapi and the rest of blazephoenix.xyz/api

    APIs

  • Public API (blazephoenix.xyz/api)

    APIs

  • BlazePhoenixStaking, BlazePhoenixMathLib

    Source code

  • https://github.com/blazephoenixxyz-crypto/Blaze-Phoenix-Dex/blob/main/llms.txt

    Source code

  • https://github.com/security/advanced-security

    Source code

  • Router, Solver, Hub, Quoter, Gate and GateWrapper, the Core and Math libraries and the BalancerV2, BalancerV3, CurveNG and CurveCryptoNG adapters — the 2.0.0 release

    Source code

  • MCP server and agent surfaces (blazephoenix.xyz/mcp, @blazephoenix/mcp)

    Products and areas

  • other

    Products and areas

  • SDK and calldata (@blazephoenix/sdk)

    Products and areas

  • Solidity contracts of the DEX aggregator (Router, Solver, Hub, Quoter, Core)

    Products and areas

  • Solidity contracts of the staking engine (BlazePhoenixStaking, BlazePhoenixMathLib)

    Products and areas

  • the route and calldata our API, MCP and front end hand to integrators

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 5

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • RPC providers and front-ends

  • the BZPX token itself is out of scope

  • The earlier 1.0.0 deployment, which the 2.0.0 release replaces.

  • Theoretical concerns without demonstrated impact

  • Third-party code: pools, tokens, bridges, wallets, RPC providers, Cloudflare, GitHub — unless our code consumes them unsafely.

Recent changes

Reward and scope changes across every BlazePhoenix program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

About this page

This page gathers every public program listed under blazephoenix.xyz: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.